Microsoft Teams Integration

Run cloud operations from Microsoft Teams by interacting with CloudThinker agents, receiving Adaptive Card alerts, and coordinating incidents.

Use Microsoft Teams to start and continue CloudThinker conversations, route work to specialists, and receive configured notifications.

---

Prerequisites

Setup starts with a CloudThinker organization owner or administrator on a messaging-eligible plan. A Global Administrator or Teams Administrator completes Microsoft provider approval and Entra consent separately. The same person can hold both roles, or they can coordinate the two steps.

Required Azure AD permissions

During the OAuth flow, CloudThinker requests the following Microsoft Graph API permissions:

Permission	Type	Purpose
User.Read	User consent	Read the signed-in user’s profile
Channel.ReadBasic.All	User consent	List channels in teams
Team.ReadBasic.All	User consent	List teams the user belongs to
TeamsAppInstallation.ReadWriteForTeam	Admin consent	Install the bot into teams
TeamsAppInstallation.ReadWriteAndConsentForTeam	Admin consent	Install the bot and grant resource-specific consent
TeamsAppInstallation.ReadWriteSelfForTeam	Admin consent	Manage the bot’s own installation
AppCatalog.ReadWrite.All	Admin consent	Publish the bot to the organization’s app catalog
Organization.Read.All	Admin consent	Read organization information

Permissions marked Admin consent can only be granted by a Global Administrator or Teams Administrator. During the OAuth flow, admins will see a “Consent on behalf of your organization” checkbox:

• Checked — permissions are granted tenant-wide for all users in the Azure AD tenant. Other admins who connect later won’t need to re-consent.
• Unchecked — permissions are granted only for the admin’s own account. This is sufficient to complete the setup since the admin personally has the required role to publish the bot.

Who should perform each step?

Responsibility	Required role
Start CloudThinker setup	CloudThinker organization owner or administrator on a messaging-eligible plan
Complete Microsoft provider approval and Entra consent	Global Administrator or Teams Administrator

---

Setup

1. Start with a CloudThinker administrator

   Sign in as a CloudThinker organization owner or administrator on a messaging-eligible plan.

2. Navigate to Integrations

   Go to Admin Settings → Integrations and find Microsoft Teams

3. Connect with Teams

   Click Connect with Teams and authenticate via Microsoft OAuth.

   A Global Administrator or Teams Administrator completes Microsoft provider approval and Entra consent. This provider-side step is separate from CloudThinker organization authorization.

4. Install the Bot

   Select which Teams to add the CloudThinker bot to and confirm the installation. The bot is published to your organization’s Teams app catalog — this is a one-time action.

5. Map Teams to Workspaces

   Map Microsoft Teams to CloudThinker workspaces. The mapping controls where ordinary Teams messages run.

6. Configure Notifications

   Configure destinations for each notification type in the notification matrix, such as cost alerts, security findings, and incident updates.

7. Test

   Start a conversation with @CloudThinker @alex show AWS costs. The platform bot mention starts a CloudThinker thread. Reply in that thread without mentioning @CloudThinker again.

---

Syntax

In Teams, use @CloudThinker to start a CloudThinker thread. Reply in an existing CloudThinker thread without mentioning the bot again. To route a request to a specialist, mention the agent’s literal alias.

@CloudThinker @alex analyze EC2 spending trends
@CloudThinker @oliver audit security groups for public access
@CloudThinker @tony check database performance
@CloudThinker @kai review EKS cluster health

All CloudThinker Language syntax works in Teams. Start a new thread with the platform bot mention, then use literal agent aliases for specialist routing.

---

Examples

Quick queries

@CloudThinker @alex what's our AWS spending this week?
@CloudThinker @oliver any critical security findings?
@CloudThinker @tony why are queries slow on production?
@CloudThinker @kai check pod status in payment namespace

With tools

@CloudThinker @alex #dashboard cost trends by service
@CloudThinker @oliver #report weekly security summary
@CloudThinker @tony #recommend index optimizations
@CloudThinker @kai #alert on pod OOMKilled events

Multi-agent

@CloudThinker @anna coordinate investigation of latency spike
@CloudThinker @alex @tony analyze database infrastructure costs

---

Alerts

Configure alert notification destinations in the notification matrix. A #alert request and a plain request can raise alerts, but neither can inline-route an alert to a #channel.

@CloudThinker @alex #alert daily spend exceeds $5,000
@CloudThinker @oliver #alert security group changes
@CloudThinker @kai #alert pod failures in production

---

Code review notifications

When an AI code review completes, CloudThinker sends an Adaptive Card notification to your configured Teams channel. The card includes:

• Severity FactSet — structured table showing counts by severity level (🔴 Critical, 🟠 High, 🟡 Medium, 🟢 Low)
• Finding details — up to 5 unresolved findings with title, severity label, file path, and line number
• Resolved count — number of previously identified findings that have been resolved
• View Code Review button — direct link to the review dashboard
• Clean pass — when no issues are found, a simple “No issues found” message

Configure code review destinations and severity thresholds in the notification matrix at Notifications > Code Review / Pipeline Monitoring. See Notifications Center for details.

Troubleshooting

Agents not responding

• Check if the CloudThinker bot is installed in the team
• Start a new conversation with @CloudThinker and use a literal alias such as @alex for specialist routing
• Reply in an existing CloudThinker thread without repeating @CloudThinker
• Confirm agents are configured in the CloudThinker console
• Check Azure AD admin consent status

Missing alerts

• Check alert configuration in CloudThinker Settings
• Verify the Teams destination in the notification matrix
• Ensure the bot has permission to post in the target channel

Permission errors

• “Missing required permissions” — A Global Administrator or Teams Administrator must complete Microsoft provider approval and Entra consent. This is separate from the CloudThinker organization owner or administrator who starts setup.
• “Consent on behalf of your organization” — During OAuth, an administrator can select this option to grant permissions tenant-wide. See the Required Azure AD permissions table for the requested scopes.
• Connection appears successful but bot doesn’t work — Confirm the bot is installed in the team, the team is mapped to the expected workspace, and Microsoft provider approval completed.
• For any other permission errors, confirm the team-to-workspace mapping or try removing and re-adding the bot to the team.

I'm not an admin — how do I set this up?

A CloudThinker organization owner or administrator on a messaging-eligible plan starts setup. A Global Administrator or Teams Administrator completes Microsoft provider approval and Entra consent. These can be different people.

1. Sign in to CloudThinker as an organization owner or administrator on a messaging-eligible plan
2. Go to Admin Settings → Integrations → Microsoft Teams
3. Click Connect with Teams and have a Global Administrator or Teams Administrator complete the Microsoft OAuth flow
4. The bot will be published to your organization’s Teams app catalog

After configuration, start a new CloudThinker thread with @CloudThinker. Replies in that thread do not need another bot mention.

---

Permissions

Microsoft provider approval and Entra consent

Global Administrator and Teams Administrator roles govern Microsoft provider approval and Entra consent. They do not replace the CloudThinker organization owner or administrator and messaging-eligible plan required to start setup.

During OAuth, the administrator can select “Consent on behalf of your organization” to grant permissions tenant-wide. See the Required Azure AD permissions table above for the requested scopes.

CloudThinker permissions

Team-to-workspace mappings control where ordinary Teams messages run. Ordinary Teams messages do not use a per-sender CloudThinker role check. A War Room input performs a linked-sender permission check.

---

Related

CloudThinker Language

Complete syntax reference for all commands

Slack Integration

Set up CloudThinker in Slack